What can I do about this clause?

{'method': 'EMAIL', 'recipient': 'privacy@notion.so', 'difficulty': 'EASY', 'action_type': 'DELETE_DATA', 'instructions': 'Email privacy@notion.so to request deletion of your personal data. Specify your account email and state that you wish to exercise your right to erasure. If you are in the EU/UK, Notion must respond within one month under GDPR Art. 17.', 'deadline_days': 30, 'deadline_hours': None}

Which regulatory agencies enforce this type of clause?

{'agency': 'FTC', 'reason': 'The FTC can take action under Section 5 against companies whose data retention practices are deceptive or unreasonable relative to their stated privacy commitments.', 'complaint_url': 'https://reportfraud.ftc.gov/'}

What is the severity of this clause?

ConductAtlas classifies this Data Retention Policy clause as medium severity. Severity reflects the magnitude of rights affected, the breadth of users impacted, and the degree of discretion the platform retains.

Do other platforms have similar clauses?

Yes. ConductAtlas has identified similar Data Retention Policy clauses across approximately 64 other tracked platforms. You can compare how platforms differ on this clause type in the cross-platform comparison view.

Data Retention Policy — Notion

Share 𝕏 Share in Share 🔒 PDF

What it is

Notion keeps your personal data for as long as it decides is necessary, which could be indefinitely unless you request deletion.

Consumer impact (what this means for users)

Your personal data, including workspace content and usage logs, may be retained by Notion indefinitely unless you actively request deletion, as the policy does not specify defined retention periods for different data categories.

What you can do

⚠️ These actions may provide transparency or partial mitigation but may not fully address the underlying issue. Effectiveness varies by jurisdiction and individual circumstances.

Delete Your Data
Within 30 days
Email privacy@notion.so to request deletion of your personal data. Specify your account email and state that you wish to exercise your right to erasure. If you are in the EU/UK, Notion must respond within one month under GDPR Art. 17.

Cross-platform context

See how other platforms handle Data Retention Policy and similar clauses.

Compare across platforms →

Need full compliance memos? See Professional →

Why it matters (compliance & risk perspective)

Vague retention language ('as long as necessary') without specific retention periods makes it difficult for users to know when their data will be deleted, and may not satisfy GDPR's storage limitation principle.

View original clause language

We retain personal information for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements, to resolve disputes, and to enforce our agreements.

Institutional analysis (Compliance & legal intelligence)

REGULATORY FRAMEWORK: This provision engages GDPR Art. 5(1)(e) (storage limitation principle — data must not be kept longer than necessary for its purpose), Art. 13(2)(a) (obligation to inform data subjects of retention periods or criteria), and CPRA's data minimization and retention limitations requirements. Enforcement authority: member state DPAs.

🔒

Compliance intelligence locked

Regulatory citations, enforcement risk, and due diligence action items.

Watcher $9.99/mo Professional $149/mo

Watcher: regulatory citations. Professional: full compliance memo.

Applicable agencies

FTC

The FTC can take action under Section 5 against companies whose data retention practices are deceptive or unreasonable relative to their stated privacy commitments.
File a complaint →

Provision details

Document information

Document

Notion Privacy Policy

Entity

Notion

Document last updated

April 29, 2026

Tracking information

First tracked

April 18, 2026

Last verified

April 18, 2026

Record ID

CA-P-002961

Document ID

CA-D-00194

Evidence Provenance

Source URL

https://www.notion.so/Privacy-Policy-3468d120cf614d4c9014c09f6adc9091

Wayback Machine

View archived versions →

SHA-256

19124e500c0301004915f6489b9f4ed5fc2ea18b26806827ad7af6913f2dd772

Verified

✓ Snapshot stored ✓ Change verified

How to Cite

ConductAtlas Policy Archive
Entity: Notion | Document: Notion Privacy Policy | Record: CA-P-002961
Captured: 2026-04-18 11:11:47 UTC | SHA-256: 19124e500c030100…
URL: https://conductatlas.com/platform/notion/notion-privacy-policy/data-retention-policy/
Accessed: May 2, 2026

Classification

Severity

Medium

Data Retention Policy